Lab: Broken brute-force protection, multiple credentials per request

Lab Scenario: Our objective is to understand and exploit a web application's broken brute-force protection, where the login credentials are submitted in JSON format. By manipulating the request to submit multiple credentials, we aim to bypass the protection mechanisms and gain unauthorized access to the targeted account. Let's embark on this journey using Burp Suite:

Investigating the Login Page:
- With Burp running, investigate the login page.
- Notice that the POST /login request submits the login credentials in JSON format.
- Send this request to Burp Repeater.
Manipulating the Request:
- In Burp Repeater, replace the single string value of the password with an array of strings containing all candidate passwords.
- For example:
```
  jsonCopy code"username" : "carlos",
  "password" : [
      "123456",
      "password",
      "qwerty",
      ...
  ]
```
- Send the modified request.
Receiving the Response:
- The modified request will return a 302 response.
- Right-click on this request and select "Show response in browser."
- Copy the URL from the browser and load it. The page loads, and you are now logged in as carlos.
Accessing the Account:
- Click "My account" to access Carlos's account page and successfully solve the lab.

Conclusion: This lab exercise provides practical insights into exploiting broken brute-force protection, showcasing the potential risks associated with vulnerabilities in authentication processes. By following this step-by-step guide, users can enhance their understanding of how attackers can manipulate login requests to bypass security measures. Stay informed, keep learning, and continue exploring the dynamic field of cybersecurity to contribute to a more secure online environment.

Reference:

https://portswigger.net/web-security/authentication/password-based/lab-broken-brute-force-protection-multiple-credentials-per-request